From e02108c54669685d9d67dd1d1b65612e20fe4172 Mon Sep 17 00:00:00 2001
From: Bryce Kwon <bryce@brycekwon.com>
Date: Sat, 7 Nov 2026 10:46:48 -1000
Subject: Check the site readme and a repository without one

The site readme reaches about-render with no tree, where only the
scheme check stands between a javascript: link and the page, and no
test rendered one. The redirect for a repository without a readme line
was checked only with no about-filter set, while the header of
about-render says the filter alone makes no about page.
---
 tests/t0501-about-render.sh | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

(limited to 'tests')

diff --git a/tests/t0501-about-render.sh b/tests/t0501-about-render.sh
index d432dd2..53aac41 100755
--- a/tests/t0501-about-render.sh
+++ b/tests/t0501-about-render.sh
@@ -72,6 +72,9 @@ test_expect_success 'point cgit at it through the about filter' '
 	repo.path=$PWD/repos/md/.git
 	repo.readme=:NOTES
 	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	repo.url=noreadme
+	repo.path=$PWD/repos/md/.git
+	repo.about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
 	EOF
 '
 
@@ -116,6 +119,35 @@ test_expect_success CGIT_LUA_LPEG 'the about page shows plain text as it is' '
 	test_grep "<pre class=.plaintext.>Plain &lt;b&gt;notes&lt;/b&gt; &amp; more" tmp
 '
 
+# The filter makes no about page of its own, so a repository without a
+# readme line sends its about page on to the summary.
+test_expect_success CGIT_LUA 'the about page wants a readme line, even with the filter' '
+	cgit_url "noreadme/about/" >tmp &&
+	test_grep "^Status: 302" tmp &&
+	test_grep "^Location: /noreadme/$" tmp
+'
+
+# The site readme has no tree behind it, which leaves the scheme check as
+# the only guard on its links.
+test_expect_success CGIT_LUA_LPEG 'the site readme turns no unsafe link into one' '
+	cat >root.md <<-\EOF &&
+	# Site
+
+	A [bad](javascript:alert%281%29) link and a [good](https://example.com/) one.
+	EOF
+	cat >rootrc <<-EOF &&
+	virtual-root=/
+	cache-size=0
+	root-readme=$PWD/root.md
+	about-filter=lua:$EXTENSIONS_DIRECTORY/about-render.lua
+	EOF
+	cgit_ok rootrc "p=about" >tmp &&
+	test_grep "<h1 id=.site.>Site</h1>" tmp &&
+	test_grep "<a href=.https://example.com/.>good</a>" tmp &&
+	test_grep "A bad link" tmp &&
+	test_grep ! "javascript:" tmp
+'
+
 test_expect_success CGIT_LUA 'without lpeg every readme is served escaped' '
 	echo "[cgit] Unable to load lpeg, so markdown and man pages show as plain text" >expect &&
 	without_lua_modules cgit_url "md/about/" >tmp 2>err &&
-- 
cgit 2.12.1